JP4847260B2 - Data processing apparatus, data processing method, and computer program - Google Patents

Description

  The present invention relates to a data processing apparatus, a data processing method, and a computer program, and is particularly suitable for use in storing job flow data in which an error has occurred during execution.

  In recent years, functions of image forming apparatuses such as printers, copiers, and facsimiles have become complicated. Furthermore, a multifunction machine (MFP) in which functions such as a printer, a copier, and a facsimile are integrated into one apparatus has been put to practical use as an image forming apparatus. In addition, image forming apparatuses have been provided with more advanced functions such as editing an image in the apparatus and performing processing in cooperation with an external apparatus that provides a service or the like. Further, MFPs capable of executing a plurality of processes (steps) as a single job flow are increasing for the purpose of simplifying the work of users in the office.

The printing apparatus described in Patent Document 1 describes that print data is deleted when the received print data does not match the print conditions.
In addition, when the designated printer is not ready for printing, the information processing apparatus described in Patent Literature 2 temporarily stores print data in a box that is a storage area of the printer. It is described that when printing becomes possible, the printer prints the print data designated by the user.

JP 2004-181739 A JP-A-2005-346180

  However, in the technique described in Patent Document 1 described above, data that has been a processing target is deleted, and therefore data that matches the printing conditions must be newly input. Therefore, for example, when the technique described in Patent Document 1 is applied to a technique for processing data using a workflow configured by a plurality of processing steps, when an error occurs that processing target data does not match the processing conditions of the process, The processing data is erased. Then, after the error recovery, when the process based on the workflow is resumed, the data to be processed is deleted, and therefore, the process of data input must be started. As a result, for example, processing performed in steps until it is determined that the processing conditions are not matched is wasted.

  The technique described in Patent Document 2 describes that print data is temporarily stored in a storage area of a printing apparatus. Therefore, as described above, in the workflow technology, when an error occurs in an intermediate processing step, the data targeted in the intermediate processing step is temporarily held in a box that is a storage area of the printing apparatus. Become.

Particularly in recent years, an increasing number of image forming apparatuses can store a large amount of data in the apparatus. Here, if the external device can access the stored data, it is possible that the data in the device is changed even if there is no malicious intention.
As a result, for example, if print data is saved in the box, but the workflow is restarted without noticing the data change, the workflow processing is restarted based on the changed data. The result may not be obtained.

  Therefore, a method of saving data in which an error has occurred in an area that cannot be accessed from an external device is conceivable. However, in such a method, for example, even if an operator in a process different from the process in which an error has occurred wants to correct the data, it cannot be accessed from an external device. As a result, the desired correct correction cannot be performed.

  The present invention has been made in view of such problems, and in a job flow in which an error has occurred during execution, the executed processing is not wasted and the data to be processed is stored. The purpose of this is to improve the safety of the data to be stored.

The data processing apparatus of the present invention includes a plurality of processes, and executes processing based on the processing content for the data in accordance with a job flow execution instruction in which processing content for processing data to be processed is defined executing means for, detecting means for detecting that the job flow by said execution means is an error in the middle of is running has occurred, when it is detected that an error has occurred by the detection means, wherein the job flow A determination unit that determines whether the job flow is selected from a selection screen dedicated to a logged-in user or a job flow selected from a selection screen for a plurality of users including the logged-in user; and the determination unit The job flow is a job flow selected from a selection screen for a plurality of users including the logged-in user. If it is determined that that, among a plurality of steps in which the error is included in the job flow that occurred with respect treated with already executed process data, validity assurance to ensure the validity of the data information while correlating to the data held in the serial憶媒body, when the job flow by said determining means is determined to be a job flow selected from the logged-in user-specific selection screen, the processed data And holding means for holding the validity guarantee information in the storage medium without associating the validity guarantee information .

The data processing method of the present invention includes a plurality of steps, and executes processing based on the processing content for the data in accordance with a job flow execution instruction in which processing content for processing data to be processed is defined an execution step of, a detection step of detecting an error in the middle of the job flow is executed by said execution step occurs, when it is detected that an error has occurred by the detection step, the job flow A determination step of determining whether the job flow is selected from a selection screen dedicated to a logged-in user or a job flow selected from selection screens for a plurality of users including the logged-in user; and the determination step The job flow from a selection screen for a plurality of users including the logged-in user If it is determined that the-option job flow, among the plurality of steps in which the error is included in the job flow that occurred to the data processed by the already executed process, guarantees the validity of the data the authenticity assurance information for wearing corresponding to the data held in the serial憶媒body, the determination if the job flow by step is determined to be a job flow selected from the logged-in user-specific selection screen A holding step of holding the validity guarantee information in the storage medium without associating the validity guarantee information with the processed data .

A computer program according to the present invention includes a plurality of steps, and executes processing based on the processing content for the data according to a job flow execution instruction in which processing content for processing data to be processed is defined. An execution step, a detection step for detecting an error while the job flow is being executed by the execution step, and when the error is detected by the detection step, the job flow is: A determination step for determining whether the job flow is selected from a selection screen dedicated to a logged-in user or a selection screen for a plurality of users including the logged-in user; and the determination step Selection for multiple users whose job flow includes the logged-in user If it is determined that the job flow selected from a surface, among the plurality of steps in which the error is included in the job flow that occurred to the data processed by the already executed process, validity of the data while correlating it to the data authenticity assurance information for guaranteeing held in serial憶媒body, wherein it is determined that the job flow is job flow selected from the logged-in user-specific selection screen by said determining step In this case, a holding step of holding the data in the storage medium without associating the validity guarantee information with the processed data is executed.

  According to the present invention, when storing data of a job flow in which an error has occurred during execution, it is possible to improve the safety of stored data without wasting a process that has already been executed.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a diagram illustrating an example of a configuration of a network system including an image forming apparatus as a data processing apparatus. In the present exemplary embodiment, a case where the image forming apparatus is a multifunction peripheral having a data transmission / reception function will be described as an example.

  In FIG. 1, a multifunction peripheral 1001 is connected to a LAN 1006 together with a multifunction peripheral 1002 having a function equivalent to that of the multifunction peripheral 1001, a facsimile machine 1003, a database / mail server 1004, and a client computer 1005. The LAN 1006 is, for example, Ethernet (registered trademark).

  The multifunction peripheral 1001 is connected to the facsimile apparatus 1007 via a public line 1008. The multifunction peripheral 1001 has a copy (document copy) function, a facsimile function, a scanner function, a printer function, and a document management function. Further, the multifunction peripheral 1001 has a data transmission function of reading a document image and transmitting the read document image data to each of the devices 1002 to 1005 connected to the LAN 1006.

  The multifunction peripheral 1001 has a function of processing data created by PDL (Page Description Language). Accordingly, the multifunction peripheral 1001 receives a print job including image data created by PDL from a computer (for example, client computer 1005) connected to the LAN 1006, and prints an image based on the image data included in the received print job. Print on.

  Further, the multifunction peripheral 1001 stores the read image data, the image data transmitted from the computer connected to the LAN 1006 and created by PDL, in the box area designated by the user in the hard disk 2004. To do. Then, the multifunction peripheral 1001 prints the image data stored in the box area. The box area refers to a part of the storage area in the hard disk, and is a storage area for storing image data and the like.

The multifunction device 1001 receives the image data read by the multifunction device 1002 via the LAN 1006, and stores the received image data in the hard disk 2004 or prints out the image data.
The other multifunction peripheral 1001 receives image data stored in the database / mail server 1004 via the client computer 1005 and the LAN 1006, and stores the received image data in the hard disk 2004 or prints out. .

The facsimile machine 1003 receives the image data read by the multifunction peripheral 1001 via the LAN 1006 and transmits the received image data to the outside.
The database / mail server 1004 receives the image data read by the multifunction peripheral 1001 via the LAN 1006, and stores the received image data as a database. Further, the database / mail server 1004 transmits the received image data as an electronic mail.

As described above, the client computer 1005 is connected to the database / mail server 1004 via the LAN 1006. Therefore, the client computer 1005 acquires desired data from the database / mail server 1004 and displays it on the display device. Further, the client computer 1005 receives the image data read by the multifunction peripheral 1001 via the LAN 1006, and processes or edits the received image data. The client computer 1050 is a personal computer, for example.
The facsimile machine 1007 receives the image data read by the multifunction peripheral 1001 via the public line 1008, and prints out the received image data.

FIG. 2 is a block diagram illustrating an example of a hardware configuration of the multifunction peripheral 1001 illustrated in FIG.
In FIG. 2, a main unit 2000 is a controller for inputting and outputting document data (image data), image information, device information, and the like. The main unit 2000 is connected to a scanner 2070 as an image input device and a printer 2080 as an image output device. The main unit 2000 controls the scanner unit 2060 and the printer unit 2070. Thereby, functions such as scanning and printing are realized.

The main unit 2000 is mutually connected to an external device such as another multifunction device 1002 or a client computer 1005 via the LAN 1006, and performs data transmission / reception with the external device. The main unit 2000 is also connected to a public line (PSTN) 1008, and implements a facsimile function using the public line 1008.
The main unit 2000 is connected to the operation unit 2050 as an interface for providing the above functions to the user.

  The CPU 2001 is a controller that controls the entire main unit 2000. A RAM 2002 is a system work memory for the CPU 2001 to operate. The RAM 2002 is also used as an image memory for temporarily storing image data. A ROM 2003 is a boot ROM. The ROM 2003 stores a system boot program and the like.

  An HDD (Hard Disk Drive) 2004 stores system software, image data, attribute data of the image data, other user data, and the like. Note that the processing performed by the main unit 200 when an error occurs during execution of the job flow is realized by system software stored in the HDD 2004. In addition, data to which an electronic signature is added in this processing is stored in the HDD 2004. Processing performed by the main unit 200 when an error occurs during the execution of the job flow will be described later. The job flow is information that includes a plurality of processes and defines processing contents for processing data to be processed.

  An operation unit I / F 2006 is an interface unit with the operation unit 2050. The operation unit I / F 2006 outputs the displayed image data to the operation unit 2050. Further, the operation unit I / F 2006 notifies the CPU 2001 of information input by the user by operating the operation unit 2050. A two-dimensional code for information notification as shown in FIG. 7 or 11 is displayed on the display unit of the operation unit 2050. A specific description of information notification by the operation unit 2050 will be described later.

  A network I / F 2007 is connected to the LAN 1006 and inputs / outputs information to / from external devices such as other multifunction devices 1002 and client computers 1005 connected to the LAN 1006. The main unit 2000 according to the present embodiment supports TCP / IP as a network communication protocol, and communicates with an external device according to the TCP / IP communication protocol.

A modem 2008 is connected to the public line 1008. A modem 2008 inputs and outputs image information to and from an external device such as a facsimile machine 1008 connected to the public line 1008 in accordance with the facsimile function of the multifunction peripheral 1001.
The signature creation / save unit 2009 creates and stores an electronic certificate used for an electronic signature and a private key corresponding to the electronic certificate using the current time and device-specific information such as a network address.
The above devices are connected to the system bus 2010.

  The image bus I / F 2005 is for connecting the system bus 2010 and an image bus 2030 for transferring image data at high speed. The image bus I / F 2005 is a bus bridge that converts a data structure. In the present embodiment, the image bus 2030 is configured to include a PCI bus or IEEE1394. The following devices are connected to the image bus 2030.

  A raster image processor (RIP) 2031 expands a PDL code included in a print job input from an external device such as a client computer 1005 connected to the LAN 1006 into a bitmap image. The device I / F 2032 connects the scanner unit 2060 and printer unit 2070, which are image input / output devices, and the main unit controller 2000, and performs synchronous / asynchronous conversion of image data.

  A scanner image processing unit 2033 performs processing such as correction, processing, and editing on the image data input from the scanner unit 2060. Further, it determines whether the image data input from the scanner unit 2060 is a color document or a monochrome document based on the saturation signal of the image, and holds the determination result.

A printer image processing unit 2034 performs processing such as correction, processing, and editing on image data output to the printer unit 2070.
The image rotation unit 2035 performs image rotation processing on the image data input from the scanner unit 2060 in cooperation with the scanner image processing unit 2033, and stores the image data subjected to the image rotation processing in a memory. In addition, the image rotation unit 2035 cooperates with the scanner image processing unit 2033 to perform image rotation processing on the image data stored in the memory, and store the image data subjected to the image rotation processing in the memory again.
In addition, the image rotation unit 2035 cooperates with the printer image processing unit 2034 to perform image rotation processing on the image data stored in the memory, and the image data subjected to the image rotation processing is converted to the device I / F 2032. To the printer unit 2070.

The resolution conversion unit 2037 performs resolution conversion processing on the image data stored in the memory, and stores again the image data subjected to the resolution conversion processing in the memory.
The color space conversion unit 2038 performs matrix calculation or the like, for example, converts YUV image data stored in the memory into Lab image data and stores the converted data in the memory.
The gradation converting unit 2039 converts image data stored in the memory, for example, 8-bit, 256-gradation image data into, for example, 1-bit, 2-gradation image data using error diffusion processing or the like. Stored in memory.

For example, the image compression unit 2036 performs JPEG compression / decompression processing on multi-valued image data, and JBIG, MMR, MR, or MH compression / decompression processing on binary image data.
The image rotation unit 2035, the resolution conversion unit 2037, the color space conversion unit 2038, the gradation conversion unit 2039, and the image compression unit 2036 can be connected to operate. For example, when image rotation processing and resolution conversion processing are performed on image data stored in the memory, the image rotation unit 2035 and the resolution conversion unit 2037 can perform these processing without going through the memory.

  FIG. 3 is a diagram illustrating an example of an external configuration of the multifunction peripheral 1001. As described above, the image forming apparatus is provided to the user as a multifunction peripheral 1001 having a copy (document copy) function, a facsimile function, a scanner function, a printer function, and a document management function.

  A scanner unit 2060 that is an image input device irradiates light on a sheet, and scans the sheet irradiated with light with a CCD line sensor, thereby converting an image on the sheet into an electrical signal as raster image data. The paper is set on the tray of the document feeder 3002. When the user operates the operation unit 2050 to give a reading start instruction, the CPU 2001 gives an instruction to the scanner unit 2060. Then, the document feeder 3002 feeds the set sheets one by one. Then, the scanner unit 2060 performs an image reading operation on the paper as described above.

  A printer unit 2070 as an image output device starts printing in response to an instruction from the CPU 2001. When printing is started, the printer unit 2070 forms an image on a sheet based on the raster image data. As a method for the printer unit 2070 to form an image on a sheet, for example, an electrophotographic method using a photosensitive drum or a photosensitive belt, an ink jet method in which ink is ejected from a minute nozzle array and an image is directly printed on the sheet, or the like. There is. In the present embodiment, either method may be employed, and other methods may be employed.

The printer unit 2070 is provided with a plurality of paper feed stages 3004 so that the user can select different paper sizes or different paper orientations. The user uses a printer unit 2070 with paper cassettes set in a plurality of paper feed stages 3004.
A paper discharge tray 3005 receives paper that has been printed. Note that the multifunction peripheral 1001 according to this embodiment can execute functions such as sorting and stapling according to instructions from the CPU 2001.

FIG. 4 is a diagram illustrating an example of a configuration (functional configuration) of system software included in the multifunction peripheral 1001 provided as the image forming apparatus. System software having the functions shown in FIG. 4 is stored in, for example, the HDD 2004 shown in FIG.
The UI control manager 4001 controls the operation unit (display unit) 2050. The UI control manager 4001 performs control for transmitting an instruction from the user to a lower module or displaying information from the lower layer on the operation unit (display unit) 2050.

The network control manager 4002 performs control for receiving instructions and information from the network (LAN 1006 and the like) and transmitting instructions and information from the main unit 2000 to the network.
The copy application unit 4003, FAX application unit 4004, and network application unit 4005 receive instructions from the UI control manager 4001 and the network control manager 4002. Then, the copy application unit 4003, the FAX application unit 4004, and the network application unit 4005 create a job file for executing the job flow, and transmit the job file to the job manager 4008 via the common I / F unit 4007.

The job application unit 4006 transmits a command for executing a job file stored in advance to the job manager 4008 via the common I / F unit 4007 based on an instruction from the UI control manager 4001.
The common I / F unit 4007 transmits information received from the copy application unit 4003, the FAX application unit 4004, the network application unit 4005, and the job application unit 4006 to the job manager 4008.

The job manager 4008 organizes the information received from the common I / F unit 4007 and controls the lower level control managers 4009 to 4014 in close contact with the device according to the arranged information.
The job manager 4008 controls the scan manager 4010 and the print manager 4009 if the process information included in the job flow received from the common I / F unit 4007 indicates execution of local copy. Specifically, the job manager 4008 causes the scan manager 4010 and the print manager 4009 to execute processes such as activation, synchronization, and termination.

  Further, in the job manager 4008, it is assumed that the process information of the process included in the job flow received from the common I / F unit 4007 indicates execution of FAX transmission. In this case, the job manager 4008 controls the scan manager 4010, the file manager 4014, and the FAX manager 4011. Specifically, the job manager 4008 causes the scan manager 4010, the file manager 4014, and the FAX manager 4011 to execute processes such as activation, synchronization, and termination.

  Furthermore, the job manager 4008 assumes that the processing information of the process included in the job flow received from the common I / F unit 4007 indicates printing of image data created by PDL. In this case, the job manager 4008 controls the PDL manager 4012, the file manager 4014, and the print manager 4009. Specifically, the job manager 4008 causes the PDL manager 4012, the file manager 4014, and the print manager 4009 to execute processes such as activation, synchronization, and termination. Specific examples of PDL include LIPS and Postscript.

When the job manager 4008 receives from the job application 4006 information on a job flow in which a plurality of processes (processes) are combined via the common I / F unit 4007, the job manager 4008 receives a plurality of process steps included in the job flow. Execute. That is, the job manager 4008 executes processing based on the processing content for the processing target data in accordance with the job flow execution instruction. Furthermore, the job manager 4008 also controls processing when an error occurs during job execution.
When an error occurs during job execution, the job manager 4008 completes up to which of the plurality of processes included in the job flow, and should restart the process from which process. I manage kikaki. This information is written in the status and end step of the job 6001 in FIG.

The signature manager 4013 executes processing such as creation of an electronic certificate, addition of an electronic signature, and verification of an electronic signature.
A file manager 4014 saves and retrieves image data and job files used in the job flow in the HDD 2004. The file manager 4014 also controls the release of data stored in the HDD 2004 to a network (LAN 1006 or the like). The file manager 4014 can also edit image data. Examples of editing include combining multiple image data, deleting pages, and the like.

FIG. 5 is a diagram illustrating an example of an external configuration of the operation unit 2050.
In FIG. 5, a touch panel sheet 5003 is pasted on an LCD (Liquid Crystal Display) provided in the LCD display unit 5002. The LCD display unit 5002 displays a system operation screen and soft keys, and transmits the position information to the CPU 2001 when the displayed soft keys are pressed.

  The start key 5004 is operated by the user when starting an image reading operation on a sheet, for example. A two-color LED 5005 of green and red is provided at the center of the start key 5004. The color of the two-color LED 5005 indicates whether the start key 5004 is ready for use. A stop key 5006 is operated by the user when stopping an operation in operation. A reset key 5007 is operated by the user when initializing settings from the operation unit 2005. A numeric keypad 5008 is operated by the user when inputting a FAX number, the number of copies, and the like.

FIG. 6 is a diagram conceptually illustrating an example of an object configuration of a job flow stored in the HDD 2004.
The multifunction peripheral 1001 according to this embodiment executes a process according to a job file having an object structure illustrated in FIG. 6 and saved in an XML (Extensible Markup Language) format. Note that the job file is copied to the HDD 2004 when the job flow is executed. Further, the job flow is managed by storing each status of the job flow in the format.
The contents of the object shown in FIG. 6 are set by the client computer 1005, for example. However, the contents of the object shown in FIG. 6 may be set by another device (for example, the multifunction peripheral 1001).

In FIG. 6, a job object 6001 includes an ID that is identification information, a job flow name, an expiration date of the job flow, a status for managing the execution state of the job flow, and an end step for storing the completed step. Etc. are provided as parameters.
The access right object 6002 manages the access right to the job flow. The access right object 6002 includes an authority type as a parameter. Specifically, the access right object 6002 stores the types of “execution right” and “editing right” as authority types. Users and groups having the authority set in the access right object 6002 are given to the user objects 6003 and 6005 and the group object 6004.

A processing object 6006 is an object that manages a process that is actually performed. The processing object 6006 includes a step number indicating the order of the steps and a processing content indicating a processing content type as parameters. Any of the objects 6007 to 6011 for managing detailed parameters is linked to the processing object 6006 according to the processing content.
For example, if the processing content of the job flow 6001 is “save → edit → print”, the process 6006 is linked to a file process 6008, an edit process 6009, and a print process 6010. Then, the processing content and processing order are stored in the processing content of the processing 6006. Thus, each object corresponding to a plurality of processing steps is set in the job flow.

The scan processing object 6007 includes detailed settings for scan processing as parameters. When the image on the paper is scanned, a data object 6012 for managing the scanned image data is linked to the scan processing object 6007.
The file processing object 6008 is linked to the processing object 6006 when a file stored in the HDD 2004 is used as data. This file processing object 6008 is linked to the data object 6013.

An edit processing object 6009 is a management object for performing editing processing on a file obtained by scanning processing or file processing. The editing process includes processes such as a merge process and a page deletion process.
A print processing object 6010 manages detailed parameters in printing such as 2 in 1 and double-sided. The transmission processing object 6011 manages detailed parameters related to transmission such as FAX transmission processing, SMTP transmission processing, SMB transmission processing, and FTP transmission processing. The destination information in the transmission process is managed as a destination information object 6014.

FIG. 7 is a diagram illustrating an example of a configuration of a display screen that displays a list of job flows. This display screen 7000 is displayed on the LCD display unit 5002 of the operation unit 2050.
As shown in FIG. 7, a job flow list is displayed as a soft button in a job flow list display area 7004. The name of the job flow is displayed on each soft button. The user can execute the job flow by pressing a button displaying the name of the desired job flow. In each job flow, processing steps to be processed in each job flow are registered.

  When the logged-in user presses my button 7001, a list of job flows that only the logged-in user has access to is displayed in the display area 7004 in the form of a soft button. When the logged-in user presses the share button 7002, a list of job flows to which other users other than the logged-in user have access rights is displayed in the display area 7004 in the form of a soft button. When the user presses the error button 7003, a list of job flows in error is displayed in the form of a soft button in the display area 7004. When the user presses the displayed soft button, the job flow in which an error has occurred. Execution resumes.

  A scroll button 7005 is operated by the user when a job flow that cannot be displayed in the display area 7004 is displayed in the display area 7004. A registration / edit button 7006 is operated by the user when registering a new job flow or editing an existing job flow.

  Next, an example of a processing procedure in the MFP 1001 when executing a job flow will be described with reference to the flowchart of FIG. The process shown in FIG. 8 starts when the job manager 4008 starts executing a soft button desired by the user from among the soft buttons displayed in the display area 7004 of the display screen 7000 shown in FIG. is there. Further, the process shown in FIG. 8 is executed based on a job file having the structure shown in FIG. Each step in the flowchart of the present application is executed by the CPU 2001 shown in FIG.

First, in step S8001, the job manager 4008 sets the value N of the internal counter to zero. The internal counter is used to count up to which process the job flow process has progressed, and is held in the RAM 2002, for example.
In step S8002, the job manager 4008 requests execution of the job flow in the (N + 1) -th process based on the job file. Specifically, the job manager 4008 requests one of the processing managers described above with reference to FIG. 4 to execute the process that is the target of the job flow according to the contents of the job flow process to be executed.

  In step S8003, the job manager 4008 determines whether an error has occurred during the execution of the job flow process requested to be executed in step S8002. Specifically, the requested processing manager notifies the job manager 4008 of processing status information of the processing execution unit. If an error occurs during the execution of the job flow process, processing status information including error information is returned to the job manager 4008 from the requested processing managers 4009 to 4012. The job manager 4008 determines whether an error has occurred based on the processing status information.

  Here, a specific example will be described. For example, the processing content of the job flow is “scan process → save process → edit process → print process”. The scanning process generates image data based on the scanned and scanned document. The storing step is assumed to be a step of storing image data generated by scanning in the storage area 1 designated in advance. The editing process is a process of combining the image data already stored in the storage area 2 and the scanned image data stored in the storage area 1. Here, in the case where normal combination is not possible, such as when the resolution of the scan processed image data stored in the storage area 1 to be combined is different from the resolution of the image data stored in the storage area 2, the file manager 4014 The join process cannot be executed, resulting in an error. In this case, the two image data to be combined remain in the storage area as they are. Here, when the storage area 1 and the storage area 2 can be accessed by any user, there is a possibility that the contents of the image data are arbitrarily changed by a user different from the user who instructed the job flow process. . In that case, the problem which this application assumes will generate | occur | produce.

  If the two image data to be combined are deleted, in order to complete the above-mentioned “scan process → save process → edit process → print process”, the already executed scan process and save process are executed again. There must be. As a result, there is a possibility that the scanning process and the storing process executed until an error occurs are wasted.

As a result of the determination in step S8003, if the job manager 4008 determines that no error has occurred during the execution of the job flow process, the process advances to step S8004. Then, the job manager 4008 adds 1 to the value N of the internal counter.
Next, in step S8005, the job manager 4008 determines whether all the steps of the job flow have been executed. If all the steps of the job flow have been completed as a result of this determination, the process is terminated. On the other hand, if all the processes of the job flow have not been completed, the process returns to step S8002 to execute the process of the next process.

  If it is determined in step S8003 that an error has occurred during the execution of the job flow process, the process advances to step S8006. Then, the job manager 4008 determines whether or not the value N of the internal counter is greater than 0 (zero). The determination in step S8006 is for determining whether there is image data (document data) to which an electronic signature is added as validity guarantee information. That is, in step S8006, it is determined whether or not at least the first process (first process) has been normally completed. As a result of the determination in step S8006, if the value N of the internal counter is not greater than 0 (if it is not the first step), the job manager 4008 determines that there is no document data to which an electronic signature is added, and performs signature processing. The process ends without

  On the other hand, if the value N of the internal counter is greater than 0, the process proceeds to step S8007. Then, the job manager 4008 requests the signature manager 4013 for electronic signature creation processing. Thereby, an electronic signature creation process is executed. This electronic signature creation process is a process of creating an electronic certificate having an expiration date equal to the expiration date of the job flow indicated in the job object 6001. Details of step S8007 will be described later with reference to FIG. In this electronic signature creation process, a private key corresponding to the electronic certificate is also created. Both the created electronic certificate and private key are stored in the signature creation storage unit 2009.

  In step S8008, the job manager 4008 requests the signature manager 4013 to perform an electronic signature addition process. Thereby, an electronic signature adding process is executed. The secret key used in this digital signature adding process is created in step S8007. Details of the electronic signature adding process will be described in detail with reference to FIG.

  Finally, in step S8009, the job manager 4008 stores the image data with the electronic signature added in the box area of the HDD 2004 and ends the process. At this time, the status of the job file is updated, and the job file before update is rewritten with the job file after update. In other words, when the job manager 4008 detects that an error has occurred, the job manager 4008 adds the validity of the data to the data processed in the already executed process among a plurality of processes included in the job flow in which the error has occurred. The validity guarantee information for guaranteeing is managed in association with each other.

  Thereafter, when the error button 7003 displayed on the display screen shown in FIG. 7 is pressed by the user, a soft button related to the job file whose status is updated is displayed in the display area 7004. The box area where image data is stored is an area accessible from an external device. That is, the image data stored in the box area is disclosed to an external device connected to the LAN 1006.

Next, an example of an electronic signature creation process in step S8007 will be described with reference to the flowchart of FIG. The process shown in FIG. 14 is executed by the signature manager 4013 in response to a request from the job manager 4008.
In step S1401, the signature manager 4013 determines whether the job flow in which an error has occurred is a personal job flow. This determination is realized by determining whether or not the button displayed by the instruction of the my button shown in FIG. 7 is instructed.

If it is determined in step S1401 that the job flow is for personal use, the signature manager 4013 determines whether the data processed in the process up to the occurrence of the error is stored in an accessible storage area. (Step S1402).
If it is determined in step S1402 that the processing target data is stored in the accessible storage area, the signature manager 4013 creates an electronic signature for guaranteeing the validity of the data stored due to the error (step S1403). Detailed processing in step S1403 will be described with reference to steps S8101 to S8103 in FIG.

Here, the validity guarantee information refers to an electronic signature generated by the signature manager 4013 based on the processing of steps S8101 to S8103 of FIGS.
That is, when an error occurs during execution of a job flow that can be executed by the first user, the signature manager 4013 guarantees the validity of the data that has been processed in the already executed process. The validity guarantee information is managed in association with each other. On the other hand, when an error occurs in the job flow that can be executed by the second user, the signature manager 4013 guarantees the validity of the data that has been processed in the already executed process. Do not manage information in association. In this way, the signature manager 4013 can switch the presence / absence of the electronic signature creation process based on the job flow attribute.

  In FIG. 14, the protection of the processing target data when the personal job flow is executed has been described, but the reverse may be possible. That is, it can be considered that the shared job flow has a larger influence on sharing than the personal job flow. In that case, the processing target data by the shared job flow may be protected.

Next, an example of the signature providing process in step S8008 will be described in detail with reference to the flowchart of FIG. The processing shown in FIG. 9 is executed by the signature manager 4013 in response to a request from the job manager 4008.
First, in step S8101, the signature manager 4013 calculates a hash value of image data to which a digital signature is added. In addition, MD5, SHA-1, etc. can be used for the hash function used when calculating a hash value, for example. The calculation of the hash value can be realized by using a known technique.

Next, in step S8102, the signature manager 4013 encrypts the hash value calculated in step S8101 using the private key corresponding to the electronic certificate created in step S8007.
In step S8103, the signature manager 4013 generates an electronic signature including the encrypted hash value and an electronic certificate created for the processing target image data. Examples of the electronic signature format include PKCS # 7 and Adobe Systems' PDF signature.

  In step S8104, the signature manager 4013 performs processing for associating the electronic signature generated in step S8103 with the image data. In order to perform the association, for example, the image data and the electronic signature may be combined as one file, or after setting the electronic signature as one of the attributes of the image data without performing direct combination, The image data and the electronic signature may be stored in the HDD 2004. That is, the electronic signature and the image data may be stored in association with each other.

  Next, an example of a processing procedure in the MFP 1001 when resuming execution of a job flow that has ended in error will be described with reference to the flowchart of FIG. The processing shown in FIG. 10 is executed by the job manager 4008 when the user presses a desired soft button from among the soft buttons displayed in the display area 7004 after the error button 7001 displayed on the display screen 7000 is pressed. Is something that starts. 10 is executed based on a job file having the structure shown in FIG.

First, in step S9001, the job manager 4008 requests the signature manager 4018 to verify the electronic signature added to the image data. As a result, verification of the electronic signature is executed. The process in step S9001 will be described in detail with reference to FIG.
In step S9002, the job manager 4008 determines the verification result of the electronic signature requested from the signature manager 4018 in step S9001. In other words, when resuming the job flow in which an error is detected, the job manager 4008 verifies the validity guarantee information associated with the data to be processed in the job flow. If the result of this determination is that the electronic signature is valid, processing proceeds to step S9005. Then, the job manager 4008 requests the processing managers 4009 to 4012 that can execute the contents of the processes to execute the remaining processes of the job flow. Thus, the remaining process of the job flow is executed in order to resume the process from the process where the error has occurred. When the remaining steps of the job flow are executed, the process ends.

  On the other hand, if the electronic signature is not valid, the process advances to step S9003. Then, the job manager 4008 notifies the user that the electronic signature is not valid. This notification is performed by displaying a confirmation message on the LCD 5002 of the operation unit 2050. FIG. 11 is a diagram showing an example of a confirmation message dialog box 1100 displayed on the display screen 7000 when an error button is designated. In this dialog box 1100, a button for executing a job flow in which an error has occurred during processing is displayed. The example of FIG. 11 shows that three job flows are in error and are being processed. Then, when the execution of the job flow is instructed to restart the job flow in error, at least one of the fact that the image data in the job flow has been changed and the job flow has expired The user is informed that this is the state. That is, the electronic signature (validity assurance information) includes information indicating the valid period of the job flow and information for enabling confirmation of whether or not the data already processed has been changed.

  Next, in step S9004, the job manager 4008 determines whether or not to continue the processing of the remaining steps of the job flow based on the user instruction to the dialog box 1100 displayed in step S9003. As a result of this determination, if processing of the remaining steps of the job flow is to be continued, the process proceeds to step S9005, where the remaining steps of the job flow are executed as described above, and the processing is terminated. On the other hand, if the processing of the remaining steps of the job flow is not continued, the processing is terminated as it is.

Next, an example of the electronic signature verification process in step S9001 will be described in detail with reference to the flowchart of FIG. The processing shown in FIG. 12 is executed by the signature manager 4018 in response to a request from the job manager 4008.
First, in step S9101, falsification / editing detection processing is performed. The specific processing contents in step S9101 are as follows. First, the signature manager 4018 decrypts the hash value included in the electronic signature using the public key in the electronic certificate included in the electronic signature. Further, the signature manager 4018 calculates a hash value from the image data of the signature target (processing target when the job flow is resumed). Then, the signature manager 4018 compares the hash value decrypted using the public key in the electronic certificate with the hash value calculated from the image data of the signature target (processing target when the job flow is resumed). If the two hash values are different as a result of this comparison, the signature manager 4018 determines that the image data has been changed, and determines that the electronic signature is invalid. On the other hand, if the two hash values are equal, the signature manager 4018 determines that the image data has not been changed, and determines that the electronic signature is valid.

  Next, in step S9102, confirmation processing of the electronic certificate used for the electronic signature is performed. The confirmation of the electronic certificate in the present embodiment is confirmation of the validity period. That is, the signature manager 4018 determines whether or not the validity period described in the electronic certificate included in the electronic signature has expired. If the validity period described in the electronic certificate has expired as a result of this determination, the signature manager 4018 determines that the validity period of the job flow has not expired and determines that the electronic signature is invalid. On the other hand, if the validity period described in the electronic certificate has not expired, the signature manager 4018 determines that the validity period of the job flow has not expired, and determines that the electronic signature is valid.

In addition, in order to more strictly check whether or not the electronic signature is valid, a CRL (Certificate Revocation List), which is a list of revoked electronic certificates, is issued from the issuer of the electronic certificate being verified. You may make it confirm.
An example of the processing described in FIGS. 8, 9, 10, and 12 will be described with reference to the conceptual diagram of FIG. In FIG. 15, it is assumed that an error has occurred in the printing process of the job flow 1500 including the process of “scan → edit → print → FAX”.

In the job flow 1500, the scanned image data is subjected to editing processing, and an error has occurred during printing of the editing result data. Here, if the image data is deleted in order to maintain the security of the image data, the already-executed scan process and edit process are wasted. On the other hand, if the editing result data is stored in a storage area accessible by the external device, it may be changed by a third party or the like, and an undesired output result may be obtained after the flow is resumed.
Therefore, in the present application, when the processed data 1501 performed up to the step where the error occurred as described above with reference to FIG. 8 is stored in the memory 1503, an electronic signature 1502 for guaranteeing the validity of the data is supported. Manage it. As a result, even if the data 1501 is changed, when the job flow is resumed, the electronic signature 1502 is compared with the data to be processed at the time of resume, and a warning screen is displayed if the change is recognized. Therefore, it becomes possible for the user who has instructed the resumption of the workflow to notice the data change.

  As described above, in this embodiment, when an error occurs during execution of a job flow including a plurality of steps, the job manager 4008 adds an electronic signature to image data that has been normally processed in the executed steps. Save them in the box area in association. At this time, the job manager 4008 creates an electronic certificate with an expiration date equal to the expiration date of the job flow, and includes the created electronic certificate in the electronic signature. Thereafter, before resuming the execution of the job flow in which an error has occurred, the job manager 4008 verifies the electronic signature added to the image data. As a result, when the image data is changed or the expiration date of the job flow has expired, this is notified to the user. It is determined whether or not to resume the execution of the job flow in which an error has occurred according to the user's operation for this notification.

In this way, by adding an electronic signature to the image data processed in the executed process, the image data processed in the executed process is valid (valid) when the remaining processes are resumed. It can be judged whether there is. When the image data processed in the executed process is not valid (valid), the user is warned. Accordingly, it is possible to prevent the remaining steps of the job flow from being executed without the user noticing that the image data processed in the executed steps is not valid (valid). Therefore, it is possible to execute the job flow more safely than before. Furthermore, since editing (changing) of image data of a job flow in which an error has occurred is not prohibited, it is possible to prevent user convenience from being reduced.
It is also conceivable to solve the problem of the present application by saving image data in a storage area that cannot be accessed by any user when an error occurs. However, if the image data that was the processing target when an error occurred is stored in a storage area that cannot be accessed by any user, the user who wants to properly change the contents of the image data cannot change it. As a result, image data not desired by the user is output.
Therefore, when an error occurs, the processing described in FIGS. 8, 9, 10, and 12 is performed while allowing the legitimate change by saving the image data in an accessible storage area, and the stored data Safety can be ensured.

  Further, the above-described verification can also be performed by an external device. Therefore, when the multifunction peripheral 1001 outputs image data of a job flow in which an error has occurred to an external device (for example, the multifunction peripheral 1002), the job flow can be executed safely on the external device as well as the multifunction peripheral 101. Is possible. Furthermore, it is possible to add and verify an electronic signature without providing a special device for confirming whether or not the job flow has been changed.

  Further, since the user is warned even when the expiration date of the job flow has expired, the user can determine whether or not to execute the job flow whose expiration date has expired. Therefore, user convenience can be further improved.

  In this embodiment, it is confirmed in step S8006 that at least the first process (first process) has been completed. However, an electronic signature is added by adding the type of job flow to be processed as a criterion. It may be determined whether there is data to be used.

  For example, it is determined whether the job flow corresponds to the soft button displayed after the my button 7001 is pressed, or whether the job flow corresponds to the soft button displayed after the share button 7002 is pressed. Judgment. Then, the job manager can determine the type of job flow to be processed. In other words, by determining whether the job flow has access rights only to the logged-in user, or to determine whether the job flow has access rights to other users other than the logged-in user, The type of job flow to be processed can be determined.

  In this case, for example, when the job flow in which an error has occurred is a job flow in which only the logged-in user has access rights, an electronic signature is created. Alternatively, an electronic signature can be created when the job flow has access rights to other users other than the logged-in user. However, a job flow that only the logged-in user has access to is less likely to be changed by a third party. Accordingly, when the job flow in which an error has occurred is a job flow that only the logged-in user has access rights to, an electronic signature may not be created.

  Furthermore, it may be determined whether there is data to which an electronic signature is added by adding to which area the errored job flow is stored as a criterion. For example, if the job flow in which an error occurred is stored in an area where the access right is not set, an electronic signature is created, and if it is stored in the area where the access right is set, An electronic signature may not be created. Here, the area where the access right is not set is, for example, a shared box (a storage area shared by a plurality of terminals), and the area where the access right is set is, for example, a personal box (a specific terminal) Storage area that can only be used. In addition, if the job flow in which an error has occurred is stored in an area that cannot be accessed from an external device (for example, the image memory of the printer), an electronic signature is not created. Otherwise, an electronic signature is created. It is also possible.

Further, whether or not there is data to which an electronic signature is added may be determined by adding whether or not a specific process (for example, an approval process) is included in the job flow in which an error has occurred, as a criterion. In this case, if a specific process (for example, an approval process) is included in the job flow in which an error has occurred, an electronic signature can be created. Otherwise, an electronic signature can be prevented from being created.
It should be noted that it is possible to determine whether or not to create an electronic signature by combining all of the determination criteria added to step S8006 as described above, or to add a part (for example, one) as a determination criterion and add an electronic signature. It may be determined whether or not to create.

  In the present embodiment, the confirmation message dialog box 1100 is displayed to notify the user even when the expiration date of the job flow has expired. However, this is not necessarily required. For example, it may be determined whether the image data in the job flow has been changed without determining the expiration date of the job flow, and a confirmation message dialog box may be displayed according to the determination result. Further, when the expiration date of the job flow has expired, the job flow may not be resumed regardless of the user's intention.

  Furthermore, in this embodiment, in step S9004 of FIG. 10, it is determined whether or not to continue the process of the remaining process of the job flow. When the process of the remaining process of the job flow is continued, in step S9005, the job The remaining steps of the flow were performed. However, this is not always necessary. For example, in step S9004, it is determined whether or not the job flow is to be executed from a predetermined process (for example, the first process). If the job flow is to be executed from the predetermined process, the job flow is You may perform from a process.

The database / mail server 1004 and the client computer 1005 are configured as shown in FIG. 13, for example. FIG. 13 is a block diagram illustrating an exemplary configuration of the database / mail server 1004 and the client computer 1005.
In FIG. 13, a CPU 1010, a ROM 1020, a RAM 1030, and a keyboard controller (KBC) 1050 of a keyboard (KB) 1040 are connected to a system bus 1130. A CRT controller (CRTC) 1070 of a CRT display (CRT) 1060 as a display unit is connected to the system bus 1130. A disk controller (DKC) 1100 of a hard disk (HD) 1080 and a flexible disk (FD) 1090 is also connected to the system bus 1130. Further, a network interface controller (NIC) 1120 for connection to the LAN 1006 is also connected to the system bus 1130.

The CPU 1010 comprehensively controls each component connected to the system bus 1130 by executing software stored in the ROM 1020 or the HD 1080 or software supplied from the FD 1090.
In other words, the CPU 1010 reads out a processing program according to a predetermined processing sequence from the ROM 1020, the HD 1080, or the FD 1090 and executes it, thereby performing control for realizing an operation described later.

The RAM 1030 functions as a main memory or work area for the CPU 1010.
The KBC 1050 controls an instruction input from the KB 1040, a pointing device (not shown), or the like.

The CRTC 1070 controls the display of the CRT 1060.
The DKC 1100 controls access to the HD 1080 and the FD 1090 that store a boot program, various applications, editing files, user files, a network management program, a predetermined processing program in the present embodiment, and the like.
The NIC 1120 exchanges data bidirectionally with devices or systems on the LAN 10061110.

Up to this point, the case where a job is executed by instructing the button of FIG. 7 has been described.
Hereafter, a case will be described as an example where a scene in which data to be processed is submitted to a storage area in which contents to be processed are set in advance, such as a hot folder. When a job flow is executed using such a storage area, the processing target data submitted to the storage area is processed according to the job flow set in the storage area when input to the storage area. This storage area stores data to be processed until processing is completed in preparation for an error during processing, and any user can access it.

  For example, assume that a job flow “editing process → printing process → FAX process” is registered in the storage area 1. The job manager 4008 monitors whether data is input to the storage area 1, and executes the job flow set in the storage area when data to be processed is input. In addition, the processing content of each process is also preset.

When the job manager 4008 executes the job flow according to the processing target data being input to the storage area in this way, if an error occurs during execution of the job flow, the data input to the storage area is stored in the storage area. Will remain.
In this case, a user different from the user who instructed the job flow process can also access the storage area, and there is a possibility that the contents of the data will be changed.
Even such a case can be dealt with by using the processes of FIGS.

For example, in the “editing process → printing process → FAX process” described as the workflow set in the storage area 1, a plurality of data is combined in the editing process, and the combined data is printed and faxed. If an error occurs in the printing process, the job manager generates an electronic signature using the hash value of the combined data, and performs processing using FIGS.
As described above, if an error occurs during job flow processing in an environment where job flow is executed and data is processed in accordance with data input to a storage area having a function such as a hot folder, the storage area is processed. Data will remain. As a result, the problem assumed by the present application is likely to occur.
However, by using the processes of FIGS. 8 to 10 and FIG. 12, even if an unintended change process is performed on the processing target data remaining in the storage area, the user who instructed the job flow process notices the unintended change. It becomes possible.

(Other embodiments of the present invention)
In order to operate various devices to realize the functions of the above-described embodiments, program codes of software for realizing the functions of the above-described embodiments are provided to an apparatus or a computer in the system connected to the various devices. You may supply. What was implemented by operating said various devices according to the program stored in the computer (CPU or MPU) of the system or apparatus is also included in the category of the present invention.

  In this case, the program code of the software itself realizes the functions of the above-described embodiment. The program code itself and means for supplying the program code to a computer, for example, a recording medium storing the program code constitute the present invention. As a recording medium for storing the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a magnetic tape, a nonvolatile memory card, a ROM, or the like can be used.

  Further, the functions of the above-described embodiments are not only realized by executing the program code supplied by the computer. It goes without saying that the program code is also included in the embodiment of the present invention even when the function of the above-described embodiment is realized in cooperation with an operating system or other application software running on the computer. Yes.

Further, after the supplied program code is stored in the memory provided in the function expansion board of the computer, the CPU provided in the function expansion board performs part or all of the actual processing based on the instruction of the program code. Needless to say, the present invention includes the case where the functions of the above-described embodiments are realized by the processing.
Further, after the supplied program code is stored in the memory provided in the function expansion unit connected to the computer, the CPU or the like provided in the function expansion unit performs part or all of the actual processing based on the instruction of the program code. Do. Needless to say, the present invention includes the case where the functions of the above-described embodiments are realized by the processing.

  It should be noted that each of the above-described embodiments is merely a specific example for carrying out the present invention, and the technical scope of the present invention should not be construed in a limited manner. . That is, the present invention can be implemented in various forms without departing from the technical idea or the main features thereof.

It is a figure which shows embodiment of this invention and shows an example of a structure of a network system. 1 is a block diagram illustrating an example of a hardware configuration of a multifunction machine according to an embodiment of the present invention. 1 is a diagram illustrating an example of an external configuration of a multifunction machine according to an embodiment of the present invention. 1 is a diagram illustrating an example of a configuration (functional configuration) of system software included in a multifunction peripheral according to an embodiment of the present invention. It is a figure which shows embodiment of this invention and shows an example of the external appearance structure of an operation part. FIG. 4 is a diagram conceptually illustrating an example of an object configuration of a job flow stored in an HDD according to the embodiment of this invention. It is a figure which shows an embodiment of the present invention and shows an example of a configuration of a display screen that displays a list of job flows. 10 is a flowchart illustrating an example of a processing procedure in the multifunction peripheral 1001 when executing a job flow according to the embodiment of this invention. It is a flowchart which shows embodiment of this invention and demonstrates an example of a signature provision process in detail. 10 is a flowchart illustrating an example of a processing procedure in the MFP 1001 when resuming execution of a job flow that has ended in error, according to the embodiment of this invention. It is a figure which shows embodiment of this invention and shows an example of the dialog box of the confirmation message displayed on the display screen. It is a flowchart which shows embodiment of this invention and demonstrates an example of an electronic signature verification process in detail. It is a block diagram which shows embodiment of this invention and shows an example of a structure of a database / mail server and a client computer. It is a flowchart which shows embodiment of this invention and demonstrates an example of an electronic signature preparation process in detail. It is a figure which shows embodiment of this invention and demonstrates an example of the conceptual diagram of this invention.

Explanation of symbols

1001, 1002 MFP 1003, 1007 Facsimile device 1004 Database / mail server 1005 Client computer 1006 LAN
1008 Public line 1100 Dialog box

Claims (12)

Execution means for executing processing based on the processing content for the data according to a job flow execution instruction that includes a plurality of steps and that defines processing content for processing data to be processed;
Detection means for detecting that an error has occurred while the job flow is being executed by the execution means;
When the detection unit detects that an error has occurred , whether the job flow is a job flow selected from a selection screen dedicated to a logged-in user or a selection screen for a plurality of users including the logged-in user Determining means for determining whether the job flow is selected from:
If the determination unit determines that the job flow is a job flow selected from a selection screen for a plurality of users including the logged-in user , among the plurality of steps included in the job flow in which the error has occurred against treated with already executed process data, hold the legitimacy guarantee information for guaranteeing the validity of the data in serial憶媒body correlated to the data, the job flow by said determining means Is stored in the storage medium without associating the validity guarantee information with the processed data, when it is determined that the job flow is selected from the selection screen dedicated to the logged-in user. A data processing apparatus comprising: The authenticity assurance information includes information indicating a validity period of the job flow, according to claim 1, characterized in that it comprises information for enabling check for changes in the already processed data Data processing device. When the execution unit resumes a job flow in which an error is detected by the detection unit, a verification unit that verifies the validity guarantee information associated with the data that is the processing target in the job flow;
By the verification unit, when the data is verified as being changed, the data processing according to claim 1 or 2, characterized by further comprising display control means for displaying said data has been changed apparatus. The execution means, among the processing contents the error is defined in the job flow is detected, according to any one of claims 1 to 3, characterized in that to resume the process from steps that an error has occurred Data processing equipment. An execution step including executing a process based on the processing content on the data in accordance with a job flow execution instruction including a plurality of steps and processing details for processing data to be processed;
A detection step for detecting that an error has occurred during execution of the job flow by the execution step;
When it is detected that an error has occurred in the detection step , whether the job flow is a job flow selected from a selection screen dedicated to a logged-in user or a selection screen for a plurality of users including the logged-in user A determination step for determining whether the job flow is selected from:
If the determination step determines that the job flow is a job flow selected from a selection screen for a plurality of users including the logged-in user , among the plurality of steps included in the job flow in which the error has occurred for already processed in the execution process data, it holds the legitimacy guarantee information for guaranteeing the validity of the data to the corresponding labeled by serial憶媒body to the data, the job flow by said determining step Is stored in the storage medium without associating the validity guarantee information with the processed data, when it is determined that the job flow is selected from the selection screen dedicated to the logged-in user. A data processing method comprising: The authenticity assurance information includes information indicating a validity period of the job flow, according to claim 5, characterized in that it comprises information for enabling check for changes in the already processed data Data processing method. When the execution step restarts the job flow in which an error has been detected by the detection step, a verification step for verifying the validity guarantee information associated with the data that has been processed in the job flow;
7. The data processing according to claim 5 , further comprising a display control step for displaying that the data is changed when the data is verified to be changed by the verification step. Method. 8. The process according to claim 5 , wherein the execution step restarts the process from the process in which the error has occurred among the process contents defined in the job flow in which the error is detected. Data processing method. An execution step including executing a process based on the processing content on the data in accordance with a job flow execution instruction including a plurality of steps and processing details for processing data to be processed;
A detection step for detecting that an error has occurred during execution of the job flow by the execution step;
When it is detected that an error has occurred in the detection step , whether the job flow is a job flow selected from a selection screen dedicated to a logged-in user or a selection screen for a plurality of users including the logged-in user A determination step for determining whether the job flow is selected from:
If the determination step determines that the job flow is a job flow selected from a selection screen for a plurality of users including the logged-in user , among the plurality of steps included in the job flow in which the error has occurred for already processed in the execution process data, it holds the legitimacy guarantee information for guaranteeing the validity of the data to the corresponding labeled by serial憶媒body to the data, the job flow by said determining step Is stored in the storage medium without associating the validity guarantee information with the processed data, when it is determined that the job flow is selected from the selection screen dedicated to the logged-in user. A computer program that is executed by a computer. 10. The validity guarantee information includes information indicating an effective period of the job flow and information for enabling confirmation of whether or not the already processed data has been changed. Computer program. When the execution step restarts the job flow in which an error has been detected by the detection step, a verification step for verifying the validity guarantee information associated with the data that has been processed in the job flow;
The computer according to claim 9 or 10, further comprising a display control step for displaying that the data has been changed when the verification has verified that the data has been changed. Computer program. 12. The process according to claim 9, wherein the execution step restarts the process from the process in which the error has occurred among the process contents defined in the job flow in which the error is detected. Computer program.

Images